What is the CVSS score of CVE-2026-34571?

CVE-2026-34571 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ci4ms are affected by CVE-2026-34571?

CI4MS versions prior to 0.31.0.0 contain a stored cross-site scripting vulnerability in user management that allows low-privilege authenticated users to inject malicious code targeting…. A patch is available.

How to fix or mitigate CVE-2026-34571?

Within 24 hours: Identify all CI4MS installations and their current versions; audit user access logs for suspicious activity in user management sections. Within 7 days: Upgrade CI4MS to version 0.31.0.0 or later; if upgrade is not immediately feasible, restrict low-privilege user access to user management functions pending patching. Within 30 days: Conduct forensic review of user management logs for the past 90 days to detect potential exploitation; reset all administrative account credentials and enforce password re-authentication across all sessions.

Ci4ms CVE-2026-34571

EUVD-2026-18088 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-01 GitHub_M

GHSA-fc4p-p49v-r948

XSS Privilege Escalation Ci4ms Ci4 Cms Erp

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 22:16 euvd

EUVD-2026-18088

Analysis Generated

Apr 01, 2026 - 22:16 vuln.today

CVE Published

Apr 01, 2026 - 21:32 nvd

CRITICAL 9.9

DescriptionGitHub Advisory

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend user management functionality. The application fails to properly sanitize user-controlled input before rendering it in the administrative interface, allowing attackers to inject persistent JavaScript code. This results in automatic execution whenever backend users access the affected page, enabling session hijacking, privilege escalation, and full administrative account compromise. This issue has been patched in version 0.31.0.0.

AnalysisAI

Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to inject malicious JavaScript that executes automatically when administrators access affected pages, enabling session hijacking and full administrative account takeover. The vulnerability affects all versions prior to 0.31.0.0 with a critical CVSS score of 9.9 due to scope change and high impact across confidentiality, integrity, and availability. EPSS data not available; no public exploit code or active exploitation confirmed at time of analysis, though the technical barrier is low (AC:L, PR:L).

Technical ContextAI

CI4MS (CodeIgniter 4-based CMS skeleton) is a modular content management framework built on the CodeIgniter 4 PHP framework, featuring role-based access control and themeable architecture for rapid application development. This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied data in the backend user management module lacks proper output encoding or sanitization before being rendered in HTML contexts. The affected component (cpe:2.3:a:ci4-cms-erp:ci4ms) fails to implement context-appropriate escaping mechanisms-likely missing htmlspecialchars() or equivalent encoding functions in CodeIgniter's view layer-allowing JavaScript payloads to persist in database records and execute in administrators' browsers. The CVSS scope change (S:C) indicates the vulnerability enables attackers to impact resources beyond the vulnerable component's security scope, characteristic of XSS attacks that can compromise administrative sessions and pivot to broader system access.

RemediationAI

Upgrade immediately to CI4MS version 0.31.0.0, which contains patches addressing the stored XSS vulnerability in backend user management functionality. The patched release is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 with corresponding security advisory documentation at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fc4p-p49v-r948. Organizations unable to upgrade immediately should implement defense-in-depth measures including restricting backend user creation privileges to trusted administrators only, implementing Content Security Policy headers to mitigate XSS execution, and conducting audits of existing user records for suspicious JavaScript patterns in fields rendered in administrative interfaces. Review application logs for unusual user account modifications or session anomalies that may indicate exploitation attempts prior to patching.